Fix use-after-free when removing a failing zlib.inflate filter (#24176)

Corrupt input makes zlib.inflate raise an E_NOTICE. An error handler can
remove the filter and free its state, so resetting the input pointers after
the notice writes to freed memory.

Release the input bucket and reset the filter state before raising the
notice, then return without accessing the filter again. Add regression
coverage for error handlers that remove both write and read filters.

Closing the stream itself from an error handler is outside this fix and
requires protection around the filter chain walk.

Closes #24176

Author: EdmondDantes

NEWS

@@ -49,6 +49,10 @@ PHP                                                                        NEWS
     is called from a progress or cancel callback during close().
     (Ilia Alshanetsky)
 
+- Zlib:
+  . Fixed use-after-free when an error handler removes a failing zlib.inflate
+    filter (GH-24176). (Edmond)
+
 22 Oct 2026, PHP 8.4.27
 
 - BCMath:

ext/zlib/tests/zlib_filter_inflate_error_handler_removes_filter.phpt

@@ -0,0 +1,30 @@
+--TEST--
+zlib.inflate filter removed by the error handler of its own notice
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+$fp = fopen('php://memory', 'w+');
+$filter = stream_filter_append($fp, 'zlib.inflate', STREAM_FILTER_WRITE);
+set_error_handler(function (int $errno, string $errstr) use (&$filter) {
+    echo $errstr, "\n";
+    var_dump(stream_filter_remove($filter));
+    return true;
+});
+var_dump(fwrite($fp, "\xff\xff\xff\xff"));
+
+$fp = fopen('php://memory', 'w+');
+fwrite($fp, "\xff\xff\xff\xff");
+rewind($fp);
+$filter = stream_filter_append($fp, 'zlib.inflate', STREAM_FILTER_READ);
+var_dump(fread($fp, 10));
+echo "Done\n";
+?>
+--EXPECT--
+fwrite(): zlib: data error
+bool(true)
+bool(false)
+fread(): zlib: data error
+bool(true)
+bool(false)
+Done

ext/zlib/zlib_filter.c

@@ -90,11 +90,12 @@ static php_stream_filter_status_t php_zlib_inflate_filter(
 				exit_status = PSFS_PASS_ON;
 			} else if (status != Z_OK && status != Z_BUF_ERROR) {
 				/* Something bad happened */
-				php_error_docref(NULL, E_NOTICE, "zlib: %s", zError(status));
 				php_stream_bucket_delref(bucket);
 				/* reset these because despite the error the filter may be used again */
 				data->strm.next_in = data->inbuf;
 				data->strm.avail_in = 0;
+				/* Last: an error handler may remove this filter and free data. */
+				php_error_docref(NULL, E_NOTICE, "zlib: %s", zError(status));
 				return PSFS_ERR_FATAL;
 			}
 			desired -= data->strm.avail_in; /* desired becomes what we consumed this round through */